Subject: Re: [dnsext] does making names the same NEED protocol changes at all?

From: Olafur Gudmundsson <[email-masked]>
Date: Thu, 03 Mar 2011 15:23:04 -0500

<no-hat>
(sorry for the late answer)

On 25/02/2011 12:43 PM, Phillip Hallam-Baker wrote:
> Requiring slaves to be signers is a major change to the security model.
>

Take a look at RFC4470.

There is no requirement that the RRSIG for a particular RRSET
from server A have be the same as is in the answer from server B for 
same question at the same time.
Only requirement is that in both cases the signatures validate.
I.e. the keys generating the signatures are in the DNSKEY for the zone, 
and that the signatures are temporarily valid.

There is nothing in DNSSEC specs that outlaws signing on all 
authoritative servers. There have been operational arguments, but
number of us have envisioned having slaves sign the negative answers on 
the fly as via schema from RFC4470+RFC4471.
There are some that even envision that servers generate dynamically 
answers for reverse IPv6 lookups and sign the dynamically generated 
answers.
Then there is the case when there is "no zone" and the answer is 
generated from information in a database and the source address of the 
query (add to that possibly data in an EDNS0 option in the query).

> In the current architecture it is sufficient to have online keys at a
> hidden master. The hidden master can be placed behind a firewall that
> rejects inbound requests.
>

You are equating architecture and operating guidance, they are not the 
same.

This is similar to in the original DNS world there was the globally 
visible holy Q-Trinity and all zone contents was provided by a MASTER 
server. Load balancers changed that to all names and types exists but 
contents may differ based on location and the world keeps evolving to 
more and more localized/personalized answers, and DNSSEC does not in any 
way prevent that.

> In the proposed architecture every DNS server has to have signing
> capability. It is not possible to prep the zone at the hidden master and
> then push the data out. The keys are not only online, they are reacting
> to queries prepared by potential attackers.
>
>
>  From a risk analysis point of view these changes are very significant
> indeed.

Yes the risks in different operating models are quite different.

	Olafur

>
>
> On Fri, Feb 25, 2011 at 12:09 PM, Tony Finch <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>     On Fri, 25 Feb 2011, Phillip Hallam-Baker wrote:
>
>      > I suspect that the point of these requirements is precisely the
>     fact that
>      > they cannot be met within the current architecture.
>
>     A lot of the argument is because we aren't sure that that is true.
>     Can the
>     requirements be met with improved provisioning technology and no
>     protocol
>     changes?
>
>      > I am seeing people rushing to change the security model of DNSSEC
>     to support
>      > this requirement, but I doubt that is going to be sufficient.
>
>     Online signing is not a change to the DNSSEC security model.
>
>     Tony.
>     --
>     f.anthony.n.finch <[email-masked] <mailto:[email-masked]>> http://dotat.at/
>     Forties, Cromarty, Forth: Southwest 5 to 7 veering northwest 4 or 5.
>     Moderate
>     or rough. Occasional rain. Moderate or good, occasionally poor.
>
>
>
>
> --
> Website: http://hallambaker.com/
>
>
>
> _______________________________________________
> dnsext mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsext

_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext